Cryptocurrency based malware and ransomware detection systems and methods

ABSTRACT

Cryptocurrency based malware and ransomware detection systems and methods are disclosed herein. An example method includes analyzing a plurality of malware or ransomware attacks to determine cryptocurrency payment address of malware or ransomware attacks, building a malware or ransomware attack database with the cryptocurrency payment addresses of the plurality of malware or ransomware attacks, identifying a proposed cryptocurrency transaction that includes an address that is included in the malware or ransomware attack database, and denying the proposed cryptocurrency transaction.

CROSS-REFERENCE TO RELATED APPLICATION(S)

This application is a continuation of U.S. patent application Ser. No.16/685,928 filed Nov. 15, 2019, entitled “Cryptocurrency Based Malwareand Ransomware Detection Systems and Methods”, which claims the benefitand priority of U.S. Provisional Application No. 62/770,113, filed onNov. 20, 2018, entitled “Malware Detection and Prevention from a RemoteServer Using Cryptocurrency Addresses”, each of which is herebyincorporated by reference herein in its entirety, including allreferences and appendices cited therein, for all purposes. Thisapplication also claims the benefit and priority of U.S. ProvisionalApplication No. 62/770,109, filed on Nov. 20, 2018, entitled “BlockchainTransaction Analysis and Anti-Money Laundering Compliance Systems andMethods”, which is hereby incorporated by reference herein in itsentirety, including all references and appendices cited therein, for allpurposes.

FIELD OF INVENTION

Embodiments of the present disclosure relate to systems and methods thatprovide cryptocurrency-based malware and ransomware detection andcryptocurrency transaction processing.

SUMMARY

A system of one or more computers can be configured to performparticular operations or actions by virtue of having software, firmware,hardware, or a combination of them installed on the system that inoperation causes or cause the system to perform the actions. One or morecomputer programs can be configured to perform particular operations oractions by virtue of including instructions that, when executed by dataprocessing apparatus, cause the apparatus to perform the actions. Onegeneral aspect includes a method comprising analyzing a plurality ofmalware or ransomware attacks by: determining a uniform resource locator(URL) of a decryptor download site of a malware or ransomware attack;determining a cryptocurrency payment address of the malware orransomware attack; determining a receipt or a decoder for the malware orransomware attack; and tracing a ransom payment paid to thecryptocurrency payment address in response to the malware or ransomwareattack; building a malware or ransomware attack database withcryptocurrency payment addresses of the plurality of malware orransomware attacks; and identifying when a proposed cryptocurrencytransaction includes an address that is included in the malware orransomware attack database.

Another embodiment includes a system comprising a processor; and amemory for storing instructions, the processor executing theinstructions to: analyze a plurality of malware or ransomware attacks todetermine cryptocurrency payment address of malware or ransomwareattacks; build a malware or ransomware attack database with thecryptocurrency payment addresses of the plurality of malware orransomware attacks; identify a proposed cryptocurrency transaction thatincludes an address that is included in the malware or ransomware attackdatabase; and deny the proposed cryptocurrency transaction.

Another embodiment includes a method comprising analyzing a plurality ofmalware or ransomware attacks to determine cryptocurrency paymentaddress of malware or ransomware attacks; building a malware orransomware attack database with the cryptocurrency payment addresses ofthe plurality of malware or ransomware attacks; identifying a proposedcryptocurrency transaction that includes an address that is included inthe malware or ransomware attack database; and denying the proposedcryptocurrency transaction.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings, where like reference numerals refer toidentical or functionally similar elements throughout the separateviews, together with the detailed description below, are incorporated inand form part of the specification, and serve to further illustrateembodiments of concepts that include the claimed disclosure and explainvarious principles and advantages of those embodiments.

The methods and systems disclosed herein have been represented whereappropriate by conventional symbols in the drawings, showing only thosespecific details that are pertinent to understanding the embodiments ofthe present disclosure so as not to obscure the disclosure with detailsthat will be readily apparent to those of ordinary skill in the arthaving the benefit of the description herein.

FIG. 1 is a schematic diagram of an example environment where aspects ofthe present disclosure can be practiced.

FIG. 2 illustrates a table comprising an example address specific riskanalysis.

FIG. 3 illustrates an example risk classification process.

FIG. 4 illustrates an example GUI (graphical user interface) thatenables users to step backward and forward through transaction historiesto discover and document risky transactions.

FIGS. 5 and 6 collectively illustrate graphs of unscored and scoredtransactions for an entity.

FIG. 7 is a flowchart of an example method of the present disclosure.

FIGS. 8A and 8B collectively illustrate an example screenshot of aransomware note displayed on an end user device.

FIG. 9 illustrates a portion of a disassembled malware code sample.

FIGS. 10A and 10B collectively illustrate a visual graphical interfacethat illustrates a transaction flow, also illustrating a reverse searchprocess for identifying additional cryptocurrency addresses involved ina malware/ransomware attack.

FIG. 11 visual graphical interface that illustrates a transaction flowand victims addresses.

FIG. 12 illustrates connections between addresses where multiple victimaddresses were transmitting cryptocurrency to a ransomware/malwareaddress.

FIG. 13 is a flowchart of an example method of the present disclosure.

FIG. 14 is a flowchart of a method for analyzing a malware or ransomwareattack.

FIG. 15 a flowchart of another method for analyzing a plurality ofmalware or ransomware attacks

FIG. 16 illustrates an exemplary computer system that may be used toimplement some or all embodiments of the system.

DETAILED DESCRIPTION

Embodiments of the present disclosure relate to systems and methods thatenable the analysis of blockchain transactions for purposes ofcompliance. For example, blockchain transactions can be analyzed throughmachine learning for evidence of malicious behavior. These analysesinclude scoring and other actionable metrics that allow entities tofulfill their compliance requirements such as anti-money launderingcompliance. Entities that can implement the present disclosure includebut are not limited to cryptocurrency exchanges/platforms, hedge funds,money service businesses, regulators (e.g., government agencies), andICO providers (initial coin offering), intelligence agencies, attorneys,auditors, banks, brokerages, and security researchers—just to name afew.

In some embodiments, the features and functions of the presentdisclosure are implemented as a web-deployed service that is accessiblethrough a secure connection. For example, the services of the presentdisclosure can be implemented on a server. The server(s) of thisdisclosure are specifically configured computing devices that areprovisioned according to the disclosures herein. In certain embodimentsthe server implements a secure application programming interface (API).The API is presented as a secure HTTP based query service with JSONencoded data. In general, the service accessible through the API allowsfor blockchain transaction analysis on a crypto wallet basis. Theservice can analyze individual blockchain transactions over a wide arrayof attributes.

The service is configured to profile countless numbers of globalexchanges, ATMs, mixers, money laundering systems, gambling services andknown criminal addresses to score transactions and assess risk. Theservice then assigns risk levels to transactions based on activityrelated to suspicious addresses and wallets. The service appliesalgorithms that calculate risk levels based on associating suspiciousaddresses and wallets. As noted herein, this can be performed using avariety of machine learning algorithms.

Also, the systems and methods disclosed herein provide a specificimprovement in a computing technology related to improving the speed ofdata calculations in the context of blockchain analysis. That is, thepresent disclosure implements high speed APIs within the technical fieldof compliance automation in order to mitigate risk. In some embodiments,a robust API is utilized which delivers real-time assessments ofcryptocurrency transaction risk. This interface can be rapidlyintegrated with an existing compliance infrastructure to providereal-time evaluations of cryptocurrency transaction risk. Thehigh-performance API quickly returns actionable risk scores for eachtransaction. Customers can then make decisions on whether to investigatea customer for violations of their AML (anti-money laundering) policy orlocal regulations. The API can automatically produce a deeper level ofanalysis to provide the level of detail required by regulators,including FinCEN, for Suspicious Activity Reports (SARs).

FIG. 1 is a schematic view of an example environment for practicingaspects of the present disclosure. The environment may include acryptocurrency address/wallet query service (hereinafter service 102), auser terminal 104, and a network 106. The service 102 can be used toquery cryptocurrency addresses/wallets/exchanges or other entities thatperform cryptocurrency transactions. These entities are generallyillustrated as entities 108A-108N. The service 102 implements an API 110that allows users to have access to the features of the service 102 suchas an address/wallet query service with transaction details and riskscores. Other features include historical addresses balance information,IP (Internet Protocol) info for addresses, and other related IP info forspecific transactions.

Communication with the service 102 occurs through the API 110 over anauthenticated connection using a self-signed certificate on the serviceside. Each customer (an entity of the entities 108A-108N) can createtheir own private key for access to the API 110. Once authenticated, theuser terminal 104 can query the server using any suitable querystructure. An example response to a query results in the identificationof wallet information for a specific address. Thus, transactionsassociated with a particular wallet ID are located, processed, andreturned with actionable metrics such as a wallet risk score. Inaddition to wallet analysis, the service can analyze specific instancesof blockchain transactions or aggregations thereof. In some embodiments,scores are created when a blockchain address is searched. These featuresare described in greater detail infra.

The service 102 may utilize various wallet data structures such as aname that identifies an owner of the wallet, a URL (uniform resourcelocator) that identifies a URL of the owning entity (if available), acountry of the owner (if available), a subpoenable value that identifiesif the entity/owner can be subpoenaed or not, as well as an entity typeidentifier. An entity can be identified as a criminal, a consumer, anexchange, or any other suitable entity identification.

Wallets can be identified from using a unique wallet identifier providedby the service 102, an owner name, an address count (number of addressesin a wallet), a revision (an incrementing revision number for thewallet. If the revision changes the wallet should be re-fetched), awallet change value (set to true if the wallet identifier has changed.The wallet can be re-fetched with the new wallet identifier), andaddress list (a list of addresses in the wallet. The set of addressesreturned depends on query parameters).

The service 102 can be configured to provide transaction query options.Transaction query options include, but are not limited to, transactionhistory for an address over a given date range, and details for a listof transactions. Transaction data structures such as a transactionhistory can comprise a structure that includes a list of transactionhashes that included the search address over a given date range. Thetransaction history can include an address which identifies an addressto query, along with a start date of the query range (unix epoch time),an end date of the query range (unix epoch time), and transactions thatcan include an array of transactions which included the searched addressas an input or output. That is, the address can be searched as adestination and/or origination address for a cryptocurrency transaction.

Structures detailing an input to a transaction can include a positionvalue (indicates a position of the input), an address (the address usedin an input), a value (indicates a total coin spend for an input).Structures detailing an output to a transaction can include similardata.

A transaction can have specific structures such as a hash (hash of aspecified transaction), a data (a date of the transaction (unix epochtime), a total (total value of the transaction, which may includeexchange or conversion fees), a fee (transaction fee), inputs(transaction inputs or originating addresses), outputs (transactionoutputs or receiving addresses), error value (indicative of any errorsduring a query process for the transaction). An address can also have aspecific structure such as wallet details for a particular address.

The service 102 can also implement structure to detail a list oftransactions such as transactions (an array of details of queriedtransactions), addresses (a map of an address to address information,such as a hash table detailing address structures for input/outputaddresses in a transaction array), and IP history (a map vector IPinformation, which includes a hash map of IP address information foraddresses and transactions contained in a wallet. These can be indexedby address or transaction hash when IP information is present).

The service 102 can allow users to query addresses. In general, addressqueries allow for determinations of address balance, transactionhistory, and IP address searches. The balance of an address can bespecified by a transaction hash for a balance, a sequential index oftransaction information (useful for sorting transactions in a block), anaddress balance after a transaction has been applied, an indication ofhow much an address contributed to a particular transaction if theaddress was identified as an input, and/or an indication of how much anaddress received to a particular transaction if the address wasidentified as an output.

IP information can be determined for an IP address that was identifiedagainst an address or transaction. The IP information can include an IPaddress, a country of the IP address, a city of the IP address, aversion string as reported, a latitude and/or longitude of the IPaddress, and/or epoch time that the IP address was determined to be amatch with an address or transaction.

Address results can include an identification of a cryptocurrencyaddress, a start and/or end date of a query, wallet information for anaddress, a current balance of an address, a number of deposits in theaddress (e.g., transaction output to address), number of spends(transaction inputs from this address), total amount deposited into andor taken out of the account, a block-height of a last transactioninvolving the address, an indication if the address is referenced, and atransaction history (within a specified date range) for the address,and/or an IP history for the address. Addresses can be queried for anending balance at a given point in time (can be either a finaltransaction balance in a returned result or the balance at a time of alast transaction with the address before a given point in time), howmuch the address has spent or received, and/or a number of deposits orpurchases made using the address.

In various embodiments, the user terminal 104 can communicate with theservice 102 in a secure and authenticated manner with a self-signedcertificate on the server side (e.g., service 102). Each customergenerates a unique 4096 bit RSA key. The user terminal 104 can providethe key back to the service 102. The service 102 can return an encryptedsecret to the user terminal. The user terminal 104 can decrypt themessage using their key. Once authenticated, the user terminal 104 cantransmit queries to the service 102. As noted above, queries can besubmitted to identify wallet information for a specified address.Another query could be submitted to identify wallet information relatedto a specific wallet identifier. A single wallet identifier can beprovided. If the wallet state has changed, the revision field will beincremented, as noted above. In this case if a user is trackingaddresses, they should proceed to re-retrieve the entire address list.Similarly, if the provided wallet identifier is an older identifier thathas been merged with other wallets a new wallet identifier will bereturned and an indication that the wallet identifier has changed isprovided.

In another use case, a single wallet identifier can be queried. Astarting address offset is provided in the query. This offset can be amultiple of 100 (any value will be rounded down to the nearest 100). Thecount parameter can be between 100 and 10000. The count parameter canalso be a multiple of 100. Offset and count are used to index throughthe address list. So, if a first query is offset=100 and count=1000 thenthe next query would be offset=1100 and count=1000 (or whatever countvalue that is preferred).

In various embodiments, the service 102 can provide a transactionhistory for a cryptocurrency address. For example, a query returns alist of transactions that have included a specified address within adate range. Another query returns details on a specified list oftransaction hashes (maximum of 10 hashes) as well as attribution datafor all addresses used in the transactions. Another query can provide anIP history map that details any IP address matches for transaction andaddress hashes included in the response. Only hashes that have IPinformation are included in the map.

The service can also provide address search functionality. An examplequery returns information regarding a cryptocurrency address. This couldinclude current balance information as well as (optional) balancehistory with transaction hashes and IP address match history. Anotherexample query can include an address parameter that specifies theaddress to search on, as well as a start date and end date (these areoptional fields that limit the date range searched (values are in unixepoch time)). The date range searched is inclusive of the starting andending date. An optional parameter can be selected which details whichtype of optional information the requester wishes (as a comma separatedlist).

In some embodiments, the service implements a distinct risk scoring APIthat allows customers to test blockchain addresses and blockchaintransactions for potential risk in order to comply with anti-moneylaundering requirements. This also allows for address and transactionmapping and analysis to prevent a suspicious transaction before thetransaction occurs. By way of example, a cryptocurrency platform mayselect to query a potential transaction looking at the wallets of theparties to a scheduled or potential transaction and the potential routeof the transaction to determine if the transaction should be allowed orcanceled. The transaction can be modeled using historical transactionsinvolving one or more of the parties. This analysis is furthereffectuated through the calculation and provision of actionable riskscores for the proposed transaction. If the risk score is high, thetransaction can be canceled and conversely allowed if the risk score isbelow a critical threshold.

In some implementations, the risk scoring API allows a platform tospecify a currency and either an address or a transaction hash. Thisinformation is utilized to specifically analyze all aspects of apotential transaction. Risk scores can be generated for an address(e.g., is this address associated with malicious activity, eitherdirectly or indirectly). Risk scores can also be generated on atransaction basis.

The service 102 can provide a transaction risk score query for atransaction. The risk score is the highest risk score of all theaddresses, both input and output, for the transaction. If a userrequires more data on the fine grained risk information, use the service102 can provide a list of the input and output transactions, and thencall anti-money-laundering/Bitcoin/address in order to get a detailedrisk score on the address which is a component of the transaction.

In some embodiments, a risk score corresponds to the following criteria:(0) Low Risk No attribution or transactions for the address; (1) LowRisk No negative attribution; (5) Caution One transaction from criminaltype activities; and (10) High Risk Multiple transactions from criminaltype activities or direct attribution to a criminal or high riskaddress. Example criminal type activities are money laundering mixers,tumblers, foggers, stolen coins, ransomware or malware, gambling sitesand Ponzi Schemes, and/or dark markets.

In various embodiments, the service 102 can provide blockchain forensicsmethodologies and systems that incorporate aspects of active attributionof data and machine learning to process the data into actionablecryptocurrency intelligence. In some embodiments, the active attributionof data provides specific information regarding cryptocurrency accounts,including data obtained from the dark market and deep web searching, aswell as analysis on full blockchain nodes. In some instances, thesystems and methods of the present disclosure obtain data from any ofthese data sources by engaging in and/or tracking specific transactionflows in various cryptocurrency exchanges. By identifying bad actors andtracking how other parties (e.g., digital wallets) interact with thesebad actors, a proposed or previously performed transaction can be scoredwith a risk score.

Example machine learning algorithms include but are not limited toBayesian clustering, inductive logic, learning classifiers,reinforcement, association, and similarity—just to name a few. Thesemachine learning algorithms are used to process the wide array of dataregarding cryptocurrency transactions and/or digital wallets. Ingeneral, these processes aggregate transactions for wallets oraddresses. In one example, all transactions occurring through a specificcrypto exchange can be aggregated and analyzed. This can also occur on aper entity basis so that individual bad actors can be identified.

In some embodiments, the service 102 can utilize information obtainedfrom various intelligence sources 112A-112N, such as proprietarydiscovery algorithms and analysts, public sources, honeypots and otheractive capture sources, trusted communities, including law enforcementand regulators, a Crypto Recovery Network, Anti-Phishing Working GroupeCrime Exchange (eCX), and so forth.

The service implements machine learning algorithms, advanced statisticalanalysis, and clustering techniques to distill meaning from this massivedata lake, resulting in a high-resolution view of the cryptocurrencyrisk land-scape. This view spans everything from dark markets tohundreds of global exchanges, delivering actionable intelligence forAML/ATF investigation and compliance monitoring.

As noted above, parties to a transaction can be identified by the riskscoring of the service 102 as criminal, dark market, gambling, mixer,ATM, and exchange. Each of these identified parties can be assigned arisk score from 1-10 with 10 indicating a highest risk.

FIG. 2 illustrates a table 200 comprising an example address specificrisk analysis. This table includes risk scores for an entity (cryptoexchange) related to the various transaction performed by that cryptoexchange within a given period of time. Risk scores are noted from 1-10and transactions are aggregated and scored to fall into one of thesescores. In total, 39% of transactions performed on the crypto exchangewere found to have a very low score of 1. Conversely, 33% were found tohave a very high risk score of 10. The crypto exchange can be scoredrelative to the breakdowns provided in any given table. Also, thesescores allow entities to be benchmarked and compared to one another interms of their specific risk score breakdowns. Thus, one crypto exchangecan be compared to one or more other crypto exchanges based on adistribution of risk scores for each crypto exchange. For example, ifanother crypto exchange has a number of transactions that fall into thevery high risk score level it could be considered “safer” than cryptoexchanges having higher numbers of transactions in the very high riskscore level.

FIG. 3 illustrates an example risk classification process. Consider aset of bitcoin addresses as nodes and transactions as edges connectingthem. Initially the process starts with a finite list of addresses thathave a risk score of 10 and no other scores set. For each of theremaining nodes that are not yet marked, the following method can beused. The method can include a step 302 where for each node (node couldbe a wallet or address), compute the number of connections to neighborswho have risk 10, which is referred to as R. In a second step 304, foreach node y, compute the number of connections to neighbors that haveR>=2. This number is referred to as C. In step 306, when R>2, considerR=2 in this step. Similarly, when C>2, consider C=2 in this step. Instep 308, for each node z, compute a risk score S by looking up row Rand column C in table 310. For trusted exchange addresses, lookup tablecan be capped at (2) two. All addresses that have been seen on ablockchain have a risk of at least (1) one. Unseen addresses have anotional risk of (0) zero unless they are listed on the 10-risk list.

The service 102 herein comprises an active attribution data process thatallows users to take advantage of live interactions with a powerfulgraph database to trace the flow of funds over time and through thecryptocurrency ecosystem. The service 102 also provides unique GUIs thatprovide powerful inspection capabilities. FIG. 4 illustrates an exampleGUI 400 that enables users to step backward and forward throughtransaction histories to discover and document risky transactions. Thisis also used to vet new customers and their sources of funds. Eachentity can be color coded according to risk level and each entity ispositioned on the visual display according to a flow of the transaction.Entities or services within the transaction flow are connected accordingto their specified interactions.

FIGS. 5 and 6 illustrate graphs of unscored and scored transactions. InFIG. 5 , a graph 500 is provided with a plurality of transactionsillustrated in a graphical format. Elements that are indicated with 10,such as elements 502-510 are indicative of addresses or wallets that areknown to be associated with malicious actors (indicated as a high risk).FIG. 6 illustrates a graph 600 which is the graph of FIG. 5 with scoresassociated with particular transactions. In this example, element 512has a calculated risk score of (9) nine due to its transactionconnections to element 506. In this example, element 506 has an input toelement 512. Element 512 also has an input from element 508. Connectionsto these two high-risk elements results in a high-risk score for element512.

FIG. 7 is a flowchart of an example method of the present disclosure.The method can include a step 702 of identifying one or morecryptocurrency accounts. This can include a customer depositing moneyinto a cryptocurrency account or otherwise purchasing cryptocurrency. Inanother example, a fund manager can invest in a cryptocurrency basedinvestment, such as an initial coin offering (ICO).

Based on the addresses and/or wallets involved in a proposedtransaction, the method can include a step 704 of generating atransaction risk for the proposed transaction. This can include any ofthe analyses disclosed herein. In step 706, transactions that are of noapparent risk are allowed to proceed. In step 708, transactions that aredetermined to be low to moderate risk may trigger an automated deepsearch for compliance reporting. In step 710, high-risk transactions areflagged for rejection. In one example use case, a cryptocurrencyexchange (e.g., an entity) can use the service 102 (see FIG. 1 ) todetermine if transactions of exchange users should be allowed orrejected based on risk scoring.

In some embodiments, the entity requesting the analysis can then makedecisions on whether to investigate a customer for violations of theirAML policy or local regulations. The service 102 can automaticallyproduce a deeper level of analysis to provide the level of detailrequired by regulators, including FinCEN, for Suspicious ActivityReports (SARs). Broadly, the service 102 can assess parameters of theaddress for each of the plurality of malware or ransomware attacks andcompare one or more addresses of the proposed cryptocurrency transactionto the parameters. Based on this analysis, a proposed cryptocurrencytransaction can be approved or denied.

Some embodiments relate malware detection and support prevention ofmalware infections from a remote server using blockchain addresses(e.g., cryptocurrency addresses). This can include a server that candetect ransomware/malware of an end user device in view of a proposedcryptocurrency transaction. The server can utilize a database ofaddresses created from known malware/ransomware crypto transactions anddetermine if any of the addresses in a proposed transaction will involveone or more of these addresses that are associated with bad actors.Processes for building the databases are also disclosed herein.

The present disclosure is also directed in some embodiments to malwaredetection and prevention from a remote server using cryptocurrencyaddresses. In some embodiments, a server (e.g., service 102) isconfigured to detect ransomware/malware of an end user device in view ofa proposed cryptocurrency transaction. The service 102 can utilize adatabase of addresses created from known malware/ransomware cryptotransactions and determine if any of the addresses in a proposedtransaction will involve one or more of these addresses that areassociated with bad actors. Processes for building the databases arealso disclosed herein.

More specifically, but not by limitation, systems and methods hereinenable the detection of malware and ransomware using a detailedtransaction and/or address (e.g., blockchain address) analyses describedabove. In some embodiments, the systems and methods herein candeconstruct and analyze algorithms used to generate malware and/orransomware. This can include tracking or tracing a malware andransomware transaction(s) and reverse engineering of the malware andransomware, as well as evaluating the algorithms used to generate themalware and/or ransomware associated addresses.

In some embodiments, malware and ransomware can be analyzed in order tolocate bitcoin and/or other cryptocurrency addresses embedded in themalware and/or ransomware package. This can be facilitated by end usershaving systems infected with malware/ransomware. The users can copy orrelay data from the malware and/or ransomware for use by the systems ofthe present disclosure.

In some embodiments, the systems and methods herein apply clusteringalgorithms disclosed to find related addresses (e.g., multi-inputaddresses) and store the same in a database. This database can includewhitelist and blacklist cryptocurrency addresses, with blacklistcryptocurrency addresses being those addresses that have been found asbeing associated with malware/ransomware events. Also, in someembodiments, machine learning based inferences can be used to determinecryptocurrency addresses that are associated with blacklistcryptocurrency addresses. For example, cryptocurrency addresses thatapproximately correspond to known malware/ransomware cryptocurrencyaddresses can be identified and blocked. This inference can befacilitated using the multivariate address and/or transaction datacollected for any given transaction or address. If an unknowncryptocurrency address possesses a similar number of attributes as aknown malware/ransomware cryptocurrency address the unknowncryptocurrency addresses can be flagged as dangerous. Further evaluationin the future may confirm or negate this inference as more data aregathered by the system or the machine learning evolves.

A public API is enabled allowing real-time transaction lookups byexchanges (or other interested entities) when a customer desires totransmit funds to a cryptocurrency address. If the endpoint address(e.g., receiving cryptocurrency address) is stored in the database or isotherwise identified as being associated with malware/ransomware theexchange is alerted in real-time or near real-time that the customer islikely infected with malware/ransomware. In some instances, thetransaction is automatically blocked, and the customer is identified.Thus, these systems and methods of the present disclosure provide ameans for detecting malware/ransomware infected end user systems withouthaving to install any software on the end user systems.

Referring back to FIG. 1 , in some embodiments, the service 102 can beadapted to include a malware or ransomware module 114 that can be usedto build a ransomware or malware database 116. In general, the malwareor ransomware module 114 can obtain parameters of a plurality of malwareand/or ransomware attacks. These parameters can be obtained frominterrogating an end user computing system or device, such as the userterminal 104. For purposes of brevity and clarity, examples providedherein will discuss detecting ransomware, but it will be appreciatedthat the methodologies disclosed herein can be extended to detectingmalware as well.

After building the database 116, cryptocurrency addresses can besearched against the database in real-time or as needed to determine ifa proposed transaction involving the cryptocurrency address should beapproved, denied, or further investigated. Example malware that can beidentified includes, but is not limited to: WannaCry, Petya/NotPetya,SamSam Ransomware, Bad Rabbit Ransomware, Jaff Ransomware, GandcrabRansomware, Pylocky Ransomware, Princess Ransomware, Locky Ransomware,CryptoLocker Ransomware, Cerber Ransomware and BitPaymer/FriedEx.

In various embodiments, indicators of compromise can be identified todetermine a specific ransomware strain if an entire computer system isnot encrypted. For example, evaluation of a process list of the end userdevice can be used to identify any suspicious processes running. A nameand details of the process can be recorded. Some embodiments includeevaluating certain locations on an end user device such as appdata,temp, or programdata as these locations typically do not requireelevated permissions to access. Another example includes identifying afile path used by the ransomware, or a registry path. Other examplesinclude identifying network information or ransomware samples or hashesof the ransomware samples.

In some embodiments, images of a display of the end user device can beused to identify information such as an attacker's email address,cryptocurrency addresses, and identifying characteristics of theransomware type. According to some embodiments, the methods disclosedherein can willingly infect or expose end user devices to ransomwareattacks so as to gain as much information for ransomware attacks aspossible and to create a robust ransomware database.

FIGS. 8A and 8B collectively illustrate an example screenshot of aransomware note 800 displayed on an end user device. A uniform resourcelocator (URL) of a decryptor download site 802 of a malware orransomware attack can be identified. A sample from the decryptordownload site 802 can be obtained after a victim has paid a ransom to avariant of the ransomware attack that generates a unique key per victim.

A cryptocurrency payment address 804 of the ransomware attack can alsobe identified. A receipt or a decoder link 806 for the malware orransomware attack can also be identified. In some embodiments, ifavailable, the service 102 can obtain a sample of the ransomware code.This may be possible in instances where the user terminal 104 is notcompleted encrypted by the ransomware.

In some instances, the malware or ransomware module 114 of the service102 can be configured to trace a ransom payment and create a visualrepresentation of the ransom payment. This can include mappingcryptocurrency addresses involved in a ransom payment.

As noted above, the malware or ransomware module 114 of the service 102can be configured to analyze a plurality of ransomware attacks todetermine cryptocurrency transactions and/or cryptocurrency addressinvolved in ransomware attacks.

FIG. 9 illustrates an example disassembly of a Coinshuffler binarymalware 900 by the malware or ransomware module 114 of the service 102.This disassembly results in the discovery of 600,000+ cryptocurrencyaddresses (a portion of which are illustrated as addresses 902) to whichfunds have been or are currently being sent. The malware or ransomwaremodule 114 can determine victims of an exchange such as Coinbase whopaid funds to these cryptocurrency addresses identified in thecryptocurrency addresses involved in the malware. The malware orransomware module 114 uses a reverse search to find related addressesfrom the malware. Addresses found in the malware are loaded into themalware or ransomware module 114. The malware or ransomware module 114then traces victim payments to one or more payoff accounts.

FIGS. 10A and 10B collectively illustrate a visual graphical interface1000 that illustrates a transaction flow 1002, illustrating a reversesearch process for identifying additional cryptocurrency addressesinvolved in a malware/ransomware attack. Individual victims andaddresses 1102A-1102D where payments were made from are illustrated inFIG. 11 , and FIG. 12 illustrates connections between addresses wheremultiple victim addresses 1202A-1202EF were transmitting cryptocurrencyto a ransomware/malware address 1204.

FIG. 13 is a flowchart of an example method of the present disclosure.The method includes an initial process of creating a malware/ransomwaredatabase that includes parameters related to a plurality of malware orransomware attacks. When the database is created, proposedcryptocurrency transactions can be searched against this database todetermine if the transaction should be approved or denied.

Thus, the method can include a step 1302 of analyzing a plurality ofmalware or ransomware attacks to determine cryptocurrency paymentaddress of malware or ransomware attacks. An example method foranalyzing a malware or ransomware attack is described above, and withrespect to FIG. 14 . The method can include a step 1304 of building amalware or ransomware attack database with the cryptocurrency paymentaddresses of the plurality of malware or ransomware attacks. Once thedatabase is established, the method can include a step 1306 ofidentifying a proposed cryptocurrency transaction that includes anaddress that is included in the malware or ransomware attack database,and a step 1308 of denying the proposed cryptocurrency transaction. Insome embodiments, the malware or ransomware attack database includesblack and white lists of cryptocurrency addresses.

FIG. 14 illustrates a flowchart of a method for analyzing a malware orransomware attack. The method can include a step 1402 of obtaining oneor more indicators of compromise of an end user device. The plurality ofmalware or ransomware attacks includes a malware or ransomware attack ofthe end user device. As noted above, this can include obtaining filepaths, registry location, hashes, and so forth of an infected end usersystem.

The method includes a step 1404 of obtaining a sample of the malware orransomware attack from a decryptor download site. This is an optionalstep that is performed if a sample can be obtained. In some embodiments,the method includes a step 1406 of identifying additional cryptocurrencyaddresses included in the sample. As illustrated in FIG. 9 , themalware/ransomware code can be disassembled, and cryptocurrencyaddresses identified. Storing the cryptocurrency addresses to themalware or ransomware attack database in step 1408.

The method can also include a step 1410 of determining victimcryptocurrency addresses that were inputs to the additionalcryptocurrency addresses using a reverse search, as well as a step 1412of determining payoff accounts linked to the victim cryptocurrencyaddresses based on a reverse search. As noted above, when acryptocurrency address has multiple inputs, it may be identified asbeing involved in malicious behavior, especially when thatcryptocurrency address has inputs that have been linked tocryptocurrency address or IP addresses of end user devices that arereported victims of an attack.

In various embodiments, the method can include a step 1414 of generatinga visual representation of cryptocurrency address analysis, whichincludes all, or a portion of the cryptocurrency addresses identifiedfor a transaction or series of transactions. In some embodiments, thiscan include applying a clustering process to identify which of thecryptocurrency payment addresses has a plurality of inputs.

FIG. 15 is a flowchart of another method for analyzing a plurality ofmalware or ransomware attacks. The method can include a step 1502 ofobtaining one or more indicators of compromise of an end user devicethat are indicative of a malware or ransomware attack. The method canfurther include a step 1504 of determining a uniform resource locator(URL) of a decryptor download site of a malware or ransomware attack,along with a step 1506 of determining a cryptocurrency payment addressof the malware or ransomware attack and a step 1508 of determining areceipt or a decoder for the malware or ransomware attack. In variousembodiments, the method can include a step 1510 of tracing a ransompayment paid to the cryptocurrency payment address in response to themalware or ransomware attack.

FIG. 16 is a diagrammatic representation of an example machine in theform of a computer system 1, within which a set of instructions forcausing the machine to perform any one or more of the methodologiesdiscussed herein may be executed. In various example embodiments, themachine operates as a standalone device or may be connected (e.g.,networked) to other machines. In a networked deployment, the machine mayoperate in the capacity of a server or a client machine in aserver-client network environment, or as a peer machine in apeer-to-peer (or distributed) network environment. The machine may be apersonal computer (PC), a tablet PC, a set-top box (STB), a personaldigital assistant (PDA), a cellular telephone, a portable music player(e.g., a portable hard drive audio device such as an Moving PictureExperts Group Audio Layer 3 (MP3) player), a web appliance, a networkrouter, switch or bridge, or any machine capable of executing a set ofinstructions (sequential or otherwise) that specify actions to be takenby that machine. Further, while only a single machine is illustrated,the term “machine” shall also be taken to include any collection ofmachines that individually or jointly execute a set (or multiple sets)of instructions to perform any one or more of the methodologiesdiscussed herein.

The example computer system 1 includes a processor or multipleprocessor(s) 5 (e.g., a central processing unit (CPU), a graphicsprocessing unit (GPU), or both), and a main memory 10 and static memory15, which communicate with each other via a bus 20. The computer system1 may further include a video display 35 (e.g., a liquid crystal display(LCD)). The computer system 1 may also include an alpha-numeric inputdevice(s) 30 (e.g., a keyboard), a cursor control device (e.g., amouse), a voice recognition or biometric verification unit (not shown),a drive unit 37 (also referred to as disk drive unit), a signalgeneration device 40 (e.g., a speaker), and a network interface device45. The computer system 1 may further include a data encryption module(not shown) to encrypt data.

The disk drive unit 37 includes a computer or machine-readable medium 50on which is stored one or more sets of instructions and data structures(e.g., instructions 55) embodying or utilizing any one or more of themethodologies or functions described herein. The instructions 55 mayalso reside, completely or at least partially, within the main memory 10and/or within the processor(s) 5 during execution thereof by thecomputer system 1. The main memory 10 and the processor(s) 5 may alsoconstitute machine-readable media.

The instructions 55 may further be transmitted or received over anetwork via the network interface device 45 utilizing any one of anumber of well-known transfer protocols (e.g., Hyper Text TransferProtocol (HTTP)). While the machine-readable medium 50 is shown in anexample embodiment to be a single medium, the term “computer-readablemedium” should be taken to include a single medium or multiple media(e.g., a centralized or distributed database and/or associated cachesand servers) that store the one or more sets of instructions. The term“computer-readable medium” shall also be taken to include any mediumthat is capable of storing, encoding, or carrying a set of instructionsfor execution by the machine and that causes the machine to perform anyone or more of the methodologies of the present application, or that iscapable of storing, encoding, or carrying data structures utilized by orassociated with such a set of instructions. The term “computer-readablemedium” shall accordingly be taken to include, but not be limited to,solid-state memories, optical and magnetic media, and carrier wavesignals. Such media may also include, without limitation, hard disks,floppy disks, flash memory cards, digital video disks, random accessmemory (RAM), read only memory (ROM), and the like. The exampleembodiments described herein may be implemented in an operatingenvironment comprising software installed on a computer, in hardware, orin a combination of software and hardware.

Some of the above-described functions may be composed of instructionsthat are stored on storage media (e.g., computer-readable medium). Theinstructions may be retrieved and executed by the processor. Someexamples of storage media are memory devices, tapes, disks, and thelike. The instructions are operational when executed by the processor todirect the processor to operate in accord with the technology. Thoseskilled in the art are familiar with instructions, processor(s), andstorage media.

In some embodiments, the computing system 100 may be implemented as acloud-based computing environment, such as a virtual machine operatingwithin a computing cloud. In other embodiments, the computing system 100may itself include a cloud-based computing environment, where thefunctionalities of the computing system 100 are executed in adistributed fashion. Thus, the computing system 100, when configured asa computing cloud, may include pluralities of computing devices invarious forms, as will be described in greater detail below.

In general, a cloud-based computing environment is a resource thattypically combines the computational power of a large grouping ofprocessors (such as within web servers) and/or that combines the storagecapacity of a large grouping of computer memories or storage devices.Systems that provide cloud-based resources may be utilized exclusivelyby their owners or such systems may be accessible to outside users whodeploy applications within the computing infrastructure to obtain thebenefit of large computational or storage resources.

The cloud is formed, for example, by a network of web servers thatcomprise a plurality of computing devices, such as the computing device100, with each server (or at least a plurality thereof) providingprocessor and/or storage resources. These servers manage workloadsprovided by multiple users (e.g., cloud resource customers or otherusers). Typically, each user places workload demands upon the cloud thatvary in real-time, sometimes dramatically. The nature and extent ofthese variations typically depends on the type of business associatedwith the user.

It is noteworthy that any hardware platform suitable for performing theprocessing described herein is suitable for use with the technology. Theterms “computer-readable storage medium” and “computer-readable storagemedia” as used herein refer to any medium or media that participate inproviding instructions to a CPU for execution. Such media can take manyforms, including, but not limited to, non-volatile media, volatile mediaand transmission media. Non-volatile media include, for example, opticalor magnetic disks, such as a fixed disk. Volatile media include dynamicmemory, such as system RAM. Transmission media include coaxial cables,copper wire and fiber optics, among others, including the wires thatcomprise one embodiment of a bus. Transmission media can also take theform of acoustic or light waves, such as those generated during radiofrequency (RF) and infrared (IR) data communications. Common forms ofcomputer-readable media include, for example, a floppy disk, a flexibledisk, a hard disk, magnetic tape, any other magnetic medium, a CD-ROMdisk, digital video disk (DVD), any other optical medium, any otherphysical medium with patterns of marks or holes, a RAM, a PROM, anEPROM, an EEPROM, a FLASHEPROM, any other memory chip or data exchangeadapter, a carrier wave, or any other medium from which a computer canread.

Various forms of computer-readable media may be involved in carrying oneor more sequences of one or more instructions to a CPU for execution. Abus carries the data to system RAM, from which a CPU retrieves andexecutes the instructions. The instructions received by system RAM canoptionally be stored on a fixed disk either before or after execution bya CPU.

Computer program code for carrying out operations for aspects of thepresent technology may be written in any combination of one or moreprogramming languages, including an object oriented programming languagesuch as Java, Smalltalk, C++ or the like and conventional proceduralprogramming languages, such as the “C” programming language or similarprogramming languages. The program code may execute entirely on theuser's computer, partly on the user's computer, as a stand-alonesoftware package, partly on the user's computer and partly on a remotecomputer or entirely on the remote computer or server. In the latterscenario, the remote computer may be connected to the user's computerthrough any type of network, including a local area network (LAN) or awide area network (WAN), or the connection may be made to an externalcomputer (for example, through the Internet using an Internet ServiceProvider).

The corresponding structures, materials, acts, and equivalents of allmeans or step plus function elements in the claims below are intended toinclude any structure, material, or act for performing the function incombination with other claimed elements as specifically claimed. Thedescription of the present technology has been presented for purposes ofillustration and description but is not intended to be exhaustive orlimited to the invention in the form disclosed. Many modifications andvariations will be apparent to those of ordinary skill in the artwithout departing from the scope and spirit of the invention. Exemplaryembodiments were chosen and described in order to best explain theprinciples of the present technology and its practical application, andto enable others of ordinary skill in the art to understand theinvention for various embodiments with various modifications as aresuited to the particular use contemplated.

While various embodiments have been described above, it should beunderstood that they have been presented by way of example only, and notlimitation. The descriptions are not intended to limit the scope of thetechnology to the particular forms set forth herein. Thus, the breadthand scope of a preferred embodiment should not be limited by any of theabove-described exemplary embodiments. It should be understood that theabove description is illustrative and not restrictive. To the contrary,the present descriptions are intended to cover such alternatives,modifications, and equivalents as may be included within the spirit andscope of the technology as defined by the appended claims and otherwiseappreciated by one of ordinary skill in the art. The scope of thetechnology should, therefore, be determined not with reference to theabove description, but instead should be determined with reference tothe appended claims along with their full scope of equivalents.

What is claimed is:
 1. A method for cryptocurrency-based malwaredetection, the method comprising: analyzing a screenshot of a ransomwarenote displayed on an end user device, associated with acryptocurrency-based malware or ransomware attack; based on theanalyzing: identifying a uniform resource locator (URL) of a decryptordownload site of the cryptocurrency-based malware or ransomware attack;and identifying a cryptocurrency payment address of thecryptocurrency-based malware or ransomware attack; identifyingadditional cryptocurrency addresses included in a sample code of thecryptocurrency-based malware or ransomware attack; storing theadditional cryptocurrency addresses to a malware or ransomware attackdatabase; tracing a ransom payment paid to the cryptocurrency paymentaddress in response to the cryptocurrency-based malware or ransomwareattack; based on the tracing of the ransom payment paid to thecryptocurrency payment address, storing the cryptocurrency paymentaddress in the malware or ransomware attack database; and identifying aproposed cryptocurrency transaction that includes an address that isincluded in the malware or ransomware attack database.
 2. The methodaccording to claim 1, further comprising determining whether a receiptor a decoder link for the cryptocurrency-based malware or ransomwareattack is available.
 3. The method according to claim 2, furthercomprising: based on determining that the receipt or the decoder link isavailable, obtaining the sample code of the cryptocurrency-based malwareor ransomware attack.
 4. The method according to claim 1, furthercomprising blocking the identified proposed cryptocurrency transaction.5. The method according to claim 1, further comprising assigning a risklevel to the proposed cryptocurrency transaction based on an activityrelated to the address.
 6. The method according to claim 1, furthercomprising alerting a cryptocurrency exchange in real-time when theproposed cryptocurrency transaction including the address is initiated.7. The method according to claim 1, further comprising: finding relatedaddresses of the address; and storing the related address in the malwareor ransomware attack database.
 8. A system, comprising: a processor; anda memory for storing instructions, the processor executing theinstructions to: analyze a screenshot of a ransomware note displayed onan end user device, associated with a cryptocurrency-based malware orransomware attack; based on the analyzing: identify a uniform resourcelocator (URL) of a decryptor download site of the cryptocurrency-basedmalware or ransomware attack; and identify a cryptocurrency paymentaddress of the cryptocurrency-based malware or ransomware attack;identify additional cryptocurrency addresses included in a sample codeof the cryptocurrency-based malware or ransomware attack; store theadditional cryptocurrency addresses to a malware or ransomware attackdatabase; trace a ransom payment paid to the cryptocurrency paymentaddress in response to the cryptocurrency-based malware or ransomwareattack; based on the tracing of the ransom payment paid to thecryptocurrency payment address, store the cryptocurrency payment addressin the malware or ransomware attack database; and identify a proposedcryptocurrency transaction that includes an address that is included inthe malware or ransomware attack database.
 9. The system according toclaim 8, wherein the processor further executes the instructions todetermine whether a receipt or a decoder link for thecryptocurrency-based malware or ransomware attack is available.
 10. Thesystem according to claim 9, wherein the processor further executes theinstructions to: based on determining that the receipt or the decoderlink is available, obtain the sample code of the cryptocurrency-basedmalware or ransomware attack.
 11. The system according to claim 8,wherein the processor further executes the instructions to block theidentified proposed cryptocurrency transaction.
 12. The system accordingto claim 8, wherein the processor further executes the instructions toassign a risk level to the proposed cryptocurrency transaction based onan activity related to the address.
 13. The system according to claim 8,wherein the processor further executes the instructions to alert acryptocurrency exchange in real-time when the proposed cryptocurrencytransaction including the address is initiated.
 14. The system accordingto claim 8, wherein the processor further executes the instructions to:find related addresses of the address; and store the related address inthe malware or ransomware attack database.
 15. A method forcryptocurrency-based malware detection, the method comprising: analyzinga screenshot of a ransomware note displayed on an end user device,associated with a cryptocurrency-based malware or ransomware attack;based on the analyzing, identifying a cryptocurrency payment address ofthe cryptocurrency-based malware or ransomware attack; identifyingadditional cryptocurrency addresses included in a sample code of thecryptocurrency-based malware or ransomware attack; storing theadditional cryptocurrency addresses to a malware or ransomware attackdatabase; tracing a ransom payment paid to the cryptocurrency paymentaddress in response to the cryptocurrency-based malware or ransomwareattack; based on the tracing of the ransom payment paid to thecryptocurrency payment address, storing the cryptocurrency paymentaddress in the malware or ransomware attack database; identifying aproposed cryptocurrency transaction that includes an address that isincluded in the malware or ransomware attack database; and denying theproposed cryptocurrency transaction.
 16. The method according to claim15, further comprising determining whether a receipt or a decoder linkfor the cryptocurrency-based malware or ransomware attack is available.17. The method according to claim 16, further comprising: based ondetermining that the receipt or the decoder link is available, obtainingthe sample code of the cryptocurrency-based malware or ransomwareattack.
 18. The method according to claim 15, further comprisingblocking the identified proposed cryptocurrency transaction.
 19. Themethod according to claim 15, further comprising assigning a risk levelto the proposed cryptocurrency transaction based on an activity relatedto the address.
 20. The method according to claim 15, further comprisingalerting a cryptocurrency exchange in real-time when the proposedcryptocurrency transaction including the address is initiated.